WO2019196921A1

WO2019196921A1 - Quantum key distribution method, device and storage medium

Info

Publication number: WO2019196921A1
Application number: PCT/CN2019/082405
Authority: WO
Inventors: 李政宇; 苏长征; 胡苏�; 邹扬
Original assignee: 华为技术有限公司
Priority date: 2018-04-13
Filing date: 2019-04-12
Publication date: 2019-10-17
Also published as: EP3780482A1; US20230188334A1; CN112865964A; CN110380844A; EP3780482A4; CN112865964B; US11595196B2; US20210044432A1; CN110380844B

Abstract

The embodiments of the present application provide a quantum key distribution method, a device, and a storage medium, being used for solving the problem in the prior art that the security of quantum key distribution between nodes is poor. In the embodiments of the present application, an ith node generates a third quantum key corresponding to the ith node of a target routing path according to a determined first quantum key corresponding to the ith node of the target routing path and a determined second quantum key corresponding to the ith node of the target routing path, and sends, to a target node of the target routing path, the third quantum key corresponding to the ith node of the target routing path, or encrypts received first ciphertext using the third quantum key corresponding to the ith node of the target routing path, and sends, to an (i+1)th node in the target routing path, obtained second ciphertext corresponding to the ith node. It can be determined that the ith node does not decrypt the received first ciphertext, thereby improving the security of quantum key distribution.

Description

Quantum key distribution method, device and storage medium

The present application claims priority to Chinese Patent Application No. 201810332715.5, entitled "A Quantum Key Distribution Method, Apparatus, and Storage Medium", filed on April 13, 2018, the entire disclosure of which is incorporated by reference. Combined in this application.

Technical field

The present application relates to the field of quantum communications, and in particular, to a quantum key distribution method, device, and storage medium.

Background technique

With the advancement of science and technology, the degree of informationization has accelerated, the frequency of communication has become more frequent, and people have become more and more demanding on the security of communication. Quantum secret communication is the product of the combination of quantum characteristics and traditional cryptography. It uses the basic principles and characteristics of quantum mechanics to ensure the security of communication. After more than 30 years of development, quantum secure communication is currently coming to market for practical use.

The closest practical quantum security communication technology at this stage is the Quantum Key Distribution (QKD) technology, which functions to realize the unconditional secure distribution of symmetric keys under the premise of sharing some security keys. FIG. 1 is a schematic diagram showing a prior art quantum key distribution method. As shown in FIG. 1, the routing path includes a source node A ₁ , a relay node A ₂ , a relay node A _{3 ,} and a destination node A ₄ . K ₁ is the quantum key to be shared between the source node A ₁ and the destination node A ₄ and needs to be transmitted from the source node A ₁ to the destination node A ₄ . In the prior art, the source node A ₁ to K ₁ K _A1A2 using encryption, to give K _{_2,} K ₂ and the resulting transmission to the relay node A _2, wherein, K _A1A2 is the source node and the relay node A ₁ A ₂ A private key shared. A ₂ using the relay node K ₂ of the decryption K _A1A2, _A2A3 K after use to encrypt K _1, K ₃ obtained, and the resultant is transmitted to the relay node K ₃ A _3, wherein, the relay node K A ₂ _A2A3 A private key shared with relay node A ₃ . A ₃ using the relay node K ₃ K to decrypt _A2A3, _A3A4 K after use to encrypt K _1, to give K _4, K ₄ and the resultant is transmitted to the destination node A _4, wherein, _A3A4 relay node K and A ₃ A private key shared by the destination node A ₄ . A ₄ using the destination node of K ₄ K _A3A4 decrypted to give K _1.

In the scheme shown in FIG. 1, the quantum key K ₁ to be shared between the source node A ₁ and the destination node A ₄ is decrypted at each intermediate node, and the security is poor.

Summary of the invention

The embodiment of the present invention provides a quantum key distribution method, device, and storage medium, which can solve the problem of poor security of quantum key distribution between nodes in the prior art.

In a first aspect, an embodiment of the present application provides a quantum key distribution method, where the method includes:

The i-th node determines, according to the first correspondence, a first quantum key corresponding to the i-th node of the target routing path, where the i-th node is the i-th node in the target routing path; the i-th node of the target routing path The first quantum key corresponding to the node is a quantum key shared between the i th node acquired by the i th node and the i th th node in the target routing path, and the first correspondence relationship includes the i th node The correspondence between the N routing paths and the N first quantum keys corresponding to the i-th node, the N routing paths and the N first quantum keys corresponding to the i-th node are in one-to-one correspondence, and the target routing path is N A routing path in a routing path, where N is a positive integer and i is a positive integer;

The i-th node determines a second quantum key corresponding to the i-th node of the target routing path according to the second correspondence, and the second quantum key corresponding to the i-th node of the target routing path is obtained by the i-th node a quantum key shared between the i-th node and the i+1th node in the target routing path, and the second correspondence relationship includes N second quantum paths corresponding to the i-th node through the N routing paths of the i-th node Corresponding relationship between the keys, the N routing paths and the N second quantum keys corresponding to the i-th node are in one-to-one correspondence;

The i-th node generates a third corresponding to the i-th node of the target routing path according to the first quantum key corresponding to the i-th node of the target routing path and the second quantum key corresponding to the i-th node of the target routing path Quantum key

The i-th node sends the third quantum key corresponding to the i-th node of the target routing path to the target node of the target routing path; or the i-th node uses the third quantum-density corresponding to the i-th node of the target routing path The key encrypts the received first ciphertext from the i-1th node in the target routing path, and sends the obtained second ciphertext corresponding to the i th node to the i+1th in the target routing path. a node, wherein the first ciphertext received by the i-th node from the i-th node in the target routing path is the second ciphertext corresponding to the i-th node sent by the i-1th node; When i is 1, the 0th node is the source node of the target routing path, and the second ciphertext corresponding to the source node of the target routing path is the second quantum key corresponding to the source node of the target routing path to the target routing path. The quantum key to be shared between the source node and the target node of the target routing path is encrypted;

The second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path; and the i th node corresponding to the target routing path corresponds to The second quantum key is the same as the first quantum key corresponding to the i+1th node of the target routing path.

In the embodiment of the present application, the second ciphertext corresponding to the source node of the target routing path is the second quantum key corresponding to the source node of the target routing path, and the source node of the target routing path and the target node of the target routing path are to be used. Encrypted by the shared quantum key, and the second ciphertext corresponding to the i-1th node sent by the i-1th node is the i-1th node from the target routing path received by the i th node The first ciphertext. The i-th node sends the third quantum key corresponding to the i-th node of the target routing path to the target node of the target routing path; or; the i-th node uses the i-th node of the target routing path to the third quantum key pair The received first ciphertext from the i-1th node in the target routing path is encrypted, and the second ciphertext corresponding to the obtained i th node is sent to the i+1th node in the target routing path. It can be seen that the i-th node does not decrypt the received first ciphertext, that is, the quantum key to be shared between the source node and the target node of the target routing path does not fall on the node, thus improving the quantum key distribution. safety.

In a possible implementation manner, if N is an integer greater than 1, the first routing path and the second routing path in the N routing paths through the i-th node: the i-th node of the first routing path The corresponding first quantum key is different from the first quantum key corresponding to the i th node of the second routing path; the second quantum key corresponding to the i th node of the first routing path and the i th second of the second routing path The second quantum key corresponding to each node is different. In this way, for each routing path, the node allocates a corresponding quantum key for the routing path, thereby implementing one-time and one-time density, which can further improve the security of quantum key distribution.

In a possible implementation manner, before the i th node determines the first quantum key corresponding to the i th node of the target routing path according to the first correspondence, the method further includes: the i th node receiving the centralized controller or the target And indicating, by the i-th node in the routing path, that the i-th node of the target routing path in the first correspondence corresponds to the first quantum key of the target routing path; or; the i-th node is configured according to The acquired network topology information of the quantum communication system and the first preset rule determine that the i-th node of the target routing path in the first correspondence corresponds to the first quantum key of the target routing path. It can be seen that the first quantum key corresponding to the node of the routing path can be determined through various schemes, thereby improving the flexibility of the scheme.

In a possible implementation, the i-th node determines, according to the acquired network topology information of the quantum communication system and the first preset rule, the first routing target path of the i-th node of the target routing path in the first correspondence relationship. a quantum key, comprising: an order relationship between the number of the nth i-1th nodes in the N routing paths through the i-th node, and N routing paths through the i-th node according to the i-th node The ordering relationship between the numbers of the nth i+1th nodes in the middle, and the ordering relationship between the numbers of the N routing paths through the i-th node, determine the N routing paths through the i-th node Sorting, and sequentially determining the first quantum key corresponding to the i-th node of the target routing path; or; the i-th node according to the N th+1th nodes of the N routing paths passing through the i-th node The ordering relationship between the numbers, and the ordering relationship between the numbers of the N routing paths through the i-th node, determine the ordering of the N routing paths through the i-th node, and sequentially determine the target routing path The corresponding node of the i-th node a quantum key; or; the i-th node determines the order of the N routing paths through the i-th node according to the ordering relationship between the numbers of the N routing paths passing through the i-th node, and sequentially determines the target The first quantum key corresponding to the i-th node of the routing path. It can be seen that the multiple routing paths of the i-th node can be sorted in multiple manners, and then the first quantum key corresponding to the i-th node of the target routing path is sequentially determined according to the sorting of the routing path, thereby The convenience and flexibility of determining the first quantum key corresponding to the i-th node of the routing path can be improved.

In a possible implementation manner, before the ith node determines the second quantum key corresponding to the i th node of the target routing path according to the second correspondence, the method further includes: the i th node receiving the centralized controller or the target And the indication information of the second quantum key corresponding to the i th node of the target routing path in the second correspondence relationship sent by the i+1th node corresponding to the routing path; or the ith node according to the acquired quantum The network topology information of the communication system and the second preset rule determine a second quantum key corresponding to the i-th node of the target routing path in the second correspondence. It can be seen that the second quantum key corresponding to the node of the routing path can be determined through various schemes, thereby improving the flexibility of the scheme.

In a possible implementation manner, the i-th node determines the e-th through the order relationship between the numbers of the W routing paths of the i-th node passing through the i-th node and the target routing path. Sorting the W routing paths of the i+1th node in the node and the target routing path, and sequentially determining the second quantum key corresponding to the i th node of the target routing path; W is a positive integer not greater than N Or; the i-th node according to the ordering relationship between the numbers of the W i+2 nodes in the W routing paths of the i+1th node passing through the i-th node and the target routing path, and The ordering relationship between the number of the W routing paths of the i-th node and the i+1th node in the target routing path, and determining the e-th node in the i-th node and the target routing path Sorting the routing paths, and sequentially determining the second quantum key corresponding to the i-th node of the target routing path. It can be seen that the multiple routing paths of the i-th node can be sorted in multiple manners, and then the second quantum key corresponding to the i-th node of the target routing path is sequentially determined according to the sorting of the routing path, thereby The convenience and flexibility of determining the second quantum key corresponding to the i-th node of the routing path can be improved.

In a possible implementation manner, the i-th node uses the third quantum key pair corresponding to the i-th node of the target routing path to receive the first from the i-1th node in the target routing path. The first algorithm for encrypting the ciphertext satisfies the formula (1) in the following specific embodiment, so that the destination node can obtain the quantum key to be shared after decrypting the received first ciphertext, and the detailed detailed analysis is performed. For the process, reference may be made to the description in the following specific embodiments, and details are not described herein again.

In a second aspect, an embodiment of the present application provides a quantum key distribution device, where the quantum key distribution device includes a memory, a transceiver, and a processor, wherein: the memory is used to store the instruction; the processor is configured to execute the instruction stored in the memory, and The control transceiver performs signal reception and signal transmission, and the quantum key distribution device is configured to perform the method of any of the above first aspect or the first aspect when the processor executes the instruction stored in the memory.

In a third aspect, the embodiment of the present application provides a quantum key distribution device, which is used to implement any one of the foregoing first aspect or the first aspect, including a corresponding functional module, respectively, for implementing the steps in the foregoing method. . The functions can be implemented in hardware or in hardware by executing the corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible design, the structure of the quantum key distribution device includes a processing unit and a transceiver unit, and the units can perform the corresponding functions in the foregoing method examples. For details, refer to the detailed description in the method example, which is not described herein.

In a fourth aspect, the embodiment of the present application provides a computer storage medium, where the computer storage medium stores instructions, when the computer is running on the computer, causing the computer to perform the method in the first aspect or any possible implementation manner of the first aspect. .

In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to perform the method of the first aspect or any possible implementation of the first aspect.

DRAWINGS

FIG. 1 is a schematic diagram showing a prior art quantum key distribution method;

2 is a schematic structural diagram of a quantum communication system according to an embodiment of the present application;

FIG. 3 is a schematic flowchart diagram of a method for allocating a quantum key according to an embodiment of the present application;

4 is a schematic diagram of a quantum key distribution method for the routing path L _{2 of} FIG. 2 according to an embodiment of the present application;

FIG. 5 is a schematic diagram of another quantum key distribution method for the routing path L _{2 of} FIG. 2 according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of a first correspondence corresponding to a node D generated by a node D in FIG. 2 according to the embodiment of the present application;

FIG. 7 is a schematic diagram of a first quantum key corresponding to a node D that generates a routing path L ₂ by using the node a3-2 in the embodiment D3 of FIG. 2 in the embodiment of the present application;

8 is a schematic diagram of a first quantum key corresponding to a node D that generates a routing path L ₂ by using the node a3-3 in the embodiment D3 of FIG. 2 in the embodiment of the present application;

FIG. 9 is a schematic diagram of a second correspondence corresponding to the node D of the embodiment D3-1 of FIG. 2 in the embodiment of the present application;

FIG. 10 is a schematic diagram of a first correspondence corresponding to a node E generated by a node E in Embodiment A3-1 of FIG. 2 in the embodiment of the present application;

FIG. 11 is a schematic diagram of a second quantum key corresponding to a node D that generates a routing path L ₂ by using the embodiment b3-2 of the node D in FIG. 2 in the embodiment of the present application;

FIG. 12 is a schematic structural diagram of a local area network division in quantum communication according to an embodiment of the present disclosure;

FIG. 13 is a schematic structural diagram of a quantum key distribution apparatus according to an embodiment of the present disclosure;

FIG. 14 is a schematic structural diagram of another quantum key distribution apparatus according to an embodiment of the present disclosure.

detailed description

FIG. 2 exemplarily shows a schematic diagram of a quantum communication system architecture provided by an embodiment of the present application. As shown in FIG. 2, the quantum communication system includes multiple nodes, such as a node B, a node C, a node D, and a node E. Node F, Node G, Node H, Node P, Node Q, and Node R. A plurality of routing paths may be formed between multiple nodes, and nodes other than the source node and the destination node in one routing path may be referred to as relay nodes. A node may act as a source node in one routing path and as a relay node or destination node in another routing path. Several routing paths are exemplarily shown in Figure 2, which are:

Routing path L ₁ "source node B - relay node D - relay node E - relay node G - destination node P";

Routing path L ₂ "source node B - relay node D - relay node E - relay node G - destination node Q";

Routing path L ₃ "source node B - relay node D - relay node E - destination node H";

Routing path L ₄ "source node C - relay node D - destination node F";

Routing path L ₅ "source node B - relay node D - destination node F";

Routing path L ₆ "Source node R - Relay node E - Destination node H".

Based on the schematic diagram of the quantum communication architecture shown in FIG. 2, the embodiment of the present application provides a quantum key distribution method, and FIG. 3 exemplarily shows a flow chart of a quantum key distribution method provided by an embodiment of the present application. As shown in FIG. 3, the method provided in this embodiment of the present application includes:

Step 301: The i-th node determines, according to the first correspondence, a first quantum key corresponding to the i-th node of the target routing path. In an optional implementation manner, the i-th node is the i-th relay node of the target routing path.

The i-th node is the i-th node in the target routing path; the first quantum key corresponding to the i-th node of the target routing path is the i-th node acquired by the i-th node and the i-th in the target routing path - a quantum key shared between the nodes, the first correspondence relationship including the correspondence between the N routing paths of the i-th node and the N first quantum keys corresponding to the i-th node, N routing paths and The N first quantum keys corresponding to the i-th node are in one-to-one correspondence, N is a positive integer, and i is a positive integer. The target routing path is any one of the N routing paths. The target routing path in this embodiment is named for convenience of description only and does not have other limited meanings.

Step 302: The i-th node determines, according to the second correspondence, a second quantum key corresponding to the i-th node of the target routing path.

The second quantum key corresponding to the i-th node of the target routing path is a quantum key shared between the i-th node acquired by the i-th node and the i+1th node in the target routing path, and the second correspondence relationship The mapping between the N routing paths of the i-th node and the N second quantum keys corresponding to the i-th node, the N routing paths and the N second quantum keys corresponding to the i-th node are in one-to-one correspondence .

Step 303, the i-th node generates the i-th of the target routing path according to the first quantum key corresponding to the i-th node of the target routing path and the second quantum key corresponding to the i-th node of the target routing path. The third quantum key corresponding to each node. After the step 303, the embodiment of the present application provides two alternative implementations. In an optional implementation, step 304 is performed after step 303, and step 305 is performed after step 303. Whether step 304 or step 305 is performed after step 303 can be flexibly and freely selected by the technician according to the actual application scenario.

Step 304: The i-th node sends the third quantum key corresponding to the i-th node of the target routing path to the target node of the target routing path.

Step 305: The i-th node encrypts the received first ciphertext from the i-th node in the target routing path by using a third quantum key corresponding to the i-th node of the target routing path, The obtained second ciphertext corresponding to the i th node is sent to the i+1th node in the target routing path.

The first ciphertext received by the i-th node from the i-1th node in the target routing path is the second ciphertext corresponding to the i-1th node sent by the i-1th node; When i is 1, the 0th node is the source node of the target routing path, and the second ciphertext corresponding to the source node of the target routing path is the second quantum key corresponding to the source node using the target routing path to the target. The quantum key to be shared between the source node of the routing path and the target node of the target routing path is encrypted.

The second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path; and the i th in the target routing path The second quantum key corresponding to the node is the same as the first quantum key corresponding to the i+1th node of the target routing path.

In the embodiment of the present application, the i th node encrypts the received first ciphertext from the i-1th node in the target routing path by using the third quantum key corresponding to the i th node of the target routing path. The algorithm can be referred to as the first algorithm. In the embodiment of the present application, the first quantum key corresponding to the i th node of the target routing path and the second quantum key corresponding to the i th node of the target routing path are generated, and the i th node corresponding to the target routing path is generated. The algorithm used in the third quantum key may be referred to as a second algorithm.

The quantum key distribution method shown in FIG. 3 above will be described in detail below with the target routing path as the routing path L ₂ in FIG. 2. FIG. 4 exemplarily shows a schematic diagram of a quantum key distribution method for the routing path L _{2 of} FIG. 2. The scheme shown in FIG. 4 performs the scheme corresponding to the above step 305. As shown in FIG. 4, the source node B and The quantum key to be shared between the destination nodes Q is K _BQ (L ₂ ), and the source node B needs to transmit the quantum key K _BQ (L ₂ ) to be shared to the destination node Q. The specific process is as follows:

As shown in FIG. 4, for the source node, the source node B acquires the quantum key K _BQ (L ₂ ) to be shared. The second quantum key corresponding to the source node B is a quantum key shared between the source node B and the relay node D corresponding to the source node B in the routing path L ₂ determined by the source node B, and K _{BD is used in} FIG. (L ₂ ) represents the second quantum key corresponding to the source node B in the routing path L ₂ .

The source node B uses the second quantum key K _BD (L ₂ ) corresponding to the source node B to perform the quantum key K _BQ (L ₂ ) to be shared between the source node of the target routing path and the target node of the target routing path. Encryption, the second ciphertext K _B (L ₂ ) corresponding to the source node B is obtained, and the source node B transmits the second ciphertext K _B (L ₂ ) corresponding to the source node to the relay node D. The algorithm for encrypting K _BQ (L ₂ ) using K _BD (L ₂ ) may be referred to as a third algorithm, and the third algorithm may be the same as the first algorithm described above, or other algorithms may be used.

Correspondingly, the relay node D receives the first ciphertext K _B (L ₂ ) from the source node B. That is to say, the second ciphertext corresponding to the source node B sent by the source node B and the first ciphertext received by the relay node D are the same ciphertext. The first ciphertext received by the relay node in the embodiment of the present application may also be referred to as the first ciphertext corresponding to the relay node, for example, the first ciphertext K _B (L ₂ ) received by the relay node D may also be used. It is called the first ciphertext K _B (L ₂ ) corresponding to the relay node D. If the target routing path is the routing path L ₂ and the D node is the i th node in the target routing path, the B node is the i-1th node of the target routing path, and the E node is the i th of the target routing path. The +1 node, the G node is similar to the i+2 node of the target routing path, and will not be described again. The relay node D is the first quantum key K _DB (L ₂ ) corresponding to the relay node D of the path according to the road target, and the second quantum key K _DE (L ₂ ) corresponding to the relay node D of the target routing path. A third quantum key K _BE (L ₂ ) corresponding to the relay node D of the target routing path is generated.

Further, the relay node D encrypts the first ciphertext K _B (L ₂ ) corresponding to the received relay node D by using the third quantum key K _BE (L ₂ ) to obtain a second corresponding to the relay node D. The ciphertext K _D (L ₂ ), the relay node D transmits the second ciphertext K _D (L ₂ ) corresponding to the relay node D to the relay node E. The algorithm for encrypting the first ciphertext K _B (L ₂ ) using the third quantum key K _BE (L ₂ ) to generate K _D (L ₂ ) of the second ciphertext may be the first algorithm.

Correspondingly, the relay node E receives the first ciphertext K _D (L ₂ ) from the relay node D. That is to say, the second ciphertext corresponding to the relay node D sent by the relay node D and the first ciphertext received by the relay node E are the same ciphertext. A second quantum key K _EG (L ₂ a first quantum repeater node E L E ₂ corresponding to the relay node according to the routing path key K _ED (L _2), the relay node and the routing path L corresponding to E ₂ A third quantum key K _DG (L ₂ ) corresponding to the relay node E of the routing path L ₂ is generated. Further, the relay node E encrypts the first ciphertext K _D (L ₂ ) using the third quantum key K _DG (L ₂ ) to obtain a second ciphertext K _E (L ₂ ) corresponding to the relay node E, The relay node E transmits the second ciphertext K _E (L ₂ ) corresponding to the relay node E to the relay node G.

Correspondingly, the relay node G receives the first ciphertext K _E (L ₂ ) from the relay node E. That is to say, the second ciphertext corresponding to the relay node E sent by the relay node E and the first ciphertext received by the relay node G are the same ciphertext. The second quantum repeater node G L G ₂ a first quantum repeater node according to the routing path corresponding to the key K _GE (L _2), the relay node and the routing path L G ₂ corresponding to the key K _GQ (L ₂ A third quantum key K _EQ (L ₂ ) corresponding to the relay node G of the routing path L ₂ is generated. Further, the relay node G encrypts the first ciphertext K _E (L ₂ ) using the third quantum key K _EQ (L ₂ ) to obtain a second ciphertext K _G (L ₂ ) corresponding to the relay node G, The relay node G transmits the second ciphertext K _G (L ₂ ) corresponding to the relay node G to the relay node Q.

Further, the destination node Q receives the first ciphertext K _G (L ₂ ) from the relay node G, and the K _G (L ₂ ) may be referred to as the first ciphertext corresponding to the destination node Q. The destination node Q decrypts the first ciphertext K _G (L ₂ ) using the first quantum key K _QG (L ₂ ) corresponding to the destination node Q of the routing path L _{2 to} obtain the quantum key to be shared as K _BQ ( L ₂ ). The algorithm used in the decryption process may be referred to as a fourth algorithm, and the fourth algorithm may be the same as the first algorithm described above, or may be other algorithms.

The destination node decrypts the first ciphertext corresponding to the destination node by using the first quantum key corresponding to the destination node of the target routing path, so as to obtain the quantum key to be shared, refer to the correlation of formula (1) in the following content. description.

FIG. 5 exemplarily shows another schematic diagram of a quantum key distribution method for the routing path L ₂ L ₂ of FIG. 2. The scheme shown in FIG. 4 performs the scheme corresponding to the above step 304, as shown in FIG. The node sends the generated K _B (L ₂ ) to the destination node Q, which can be transmitted through the classical signal or through the quantum channel. Each relay node also transmits a third quantum key generated corresponding to each relay node to the destination node Q. For example, in FIG. 5, the relay node D transmits the third quantum key K _BE (L ₂ ) corresponding to the relay node D of the generated routing path L ₂ to the destination node Q, and the relay node E will generate the routing path L. the relay node E ₂ corresponding to the third quantum key K _DG (L ₂₎ is sent to the destination node Q, the third quantum routing path of the generated relay node G L G ₂ corresponding to the relay node key K _EQ (L ₂ ) is sent to the destination node Q, and the destination node Q encrypts K _B (L ₂ ) using K _BE (L ₂ ), and encrypts the obtained result using K _DG (L ₂ ), and then obtains the result. The result is encrypted using K _EQ (L ₂ ), and then the obtained result is decrypted using K _QG (L ₂ ), thereby obtaining the quantum key K _BQ (L ₂ ) to be shared. It can be seen that in the solution, each relay node sends the third quantum key to the destination node, so that the operation time of each relay node can be saved, and the quantum key distribution efficiency can be further improved.

It can be seen from the examples shown in FIG. 4 and FIG. 5 that, in the embodiment of the present application, the relay node no longer decrypts the information sent by the previous node of the relay node, so that the source node can be made. The quantum key to be shared with the destination node is no longer in the relay node, that is, the relay node does not decrypt the quantum key to be shared between the source node and the destination node, and can improve the relationship between the source node and the destination node. The security of the quantum key to be shared.

Secondly, the relay node no longer encrypts and decrypts the information sent by the previous node of the relay node, which can save time and resources occupied by the photoelectric conversion of the quantum key to be shared on the routing path.

Third, in the embodiment of the present application, the relay node may delete the first quantum key and the second quantum key corresponding to the relay node after generating the third quantum key, and it can be seen that the relay node may not leave The window period under attack reduces the ability of the eavesdropper to decrypt the quantum key to be shared, thereby further improving the security of information transmission during the quantum key distribution process.

Fourth, the related information of the third quantum key of the relay node can be published, so that the secure storage requirement for the information can be reduced. This lays the foundation for further realizing that all information related to the attributes of the relay node is published. A node can publish a log of the operation and access conditions when the node acts as a relay node on a routing path, and the chip itself. Resource utilization. In this process, the intermediate steps of calculating the third quantum key of the relay node and the related information results used in the middle are not public. In the embodiment of the present application, the relay node may disclose related information, such as a log of the operation and access status of the relay node, so as to help analyze the network running status, thereby improving the transparency to the client.

In the embodiment of the present application, the second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path, and the target route is The second quantum key corresponding to the i-th node in the path is the same as the first quantum key corresponding to the i+1th node of the target routing path. For example, in FIG. 4, K _BD (L ₂ ) is the same as K _DB (L ₂ ), K _DE (L ₂ ) is the same as K _ED (L ₂ ), and K _EG (L ₂ ) is the same as K _GE (L ₂ ). K _GQ (L ₂ ) is the same as K _QG (L ₂ ), so that the destination node can resolve the quantum key to be shared.

The above-mentioned FIG. 4 and FIG. 5 are described by taking the first algorithm and the second algorithm as an exclusive OR algorithm. Those skilled in the art may know that the first algorithm and the second algorithm may also be other algorithms. In the foregoing step 303, the i-th node of the target routing path is generated according to the first quantum key corresponding to the i-th node of the target routing path and the second quantum key corresponding to the i-th node of the target routing path. The algorithm used in the corresponding third quantum key is a second algorithm, and the i-th node uses the third quantum key pair corresponding to the i-th node of the target routing path to receive the first from the target routing path. The algorithm for encrypting the first ciphertext of i-1 nodes is the first algorithm.

In an alternative embodiment, the first algorithm satisfies equation (1):

g(f _E (K _i-1,i-2 (L _j ),K _i-1,i (L _j )),f _E (K _i,i-1 (L _j ),K _i,i+1 (L _j )))=f _E (K _i-1,i-2 (L _j ),K _i,i+1 (L _j ))...Formula (1)

In formula (1), L _{j is} an identifier of the target routing path;

K _i-1,i-2 (L _j ) is the first quantum key corresponding to the i-1th node in the target routing path L _j ;

K _i-1,i (L _j ) is a second quantum key corresponding to the i-1th node in the target routing path L _j ;

K _i,i-1 (L _j ) is the first quantum key corresponding to the i th node in the target routing path L _j ;

K _i,i+1 (L _j ) is a second quantum key corresponding to the i th node in the target routing path L _j ;

Where f _E (·) is a function corresponding to the second algorithm, and the second algorithm is a first quantum key corresponding to the i-th node of the target routing path and a second corresponding to the i-th node of the target routing path a quantum key, an algorithm used to generate a third quantum key corresponding to the i-th node of the target routing path;

g(·) is a function corresponding to the first algorithm.

For example, in combination with FIG. 4, for example, when the i-th node is the relay node E, the above formula (1) can be correspondingly written as:

g(f _E (K _DB (L ₂ ), K _DE (L ₂ )), f _E (K _ED (L ₂ ), K _EG (L ₂ )))=f _E (K _DB (L ₂ ), K _EG (L ₂ ))

_{_{Wherein, f E (K DB (L}} 2), K DE (L 2)) is a first routing path quantum repeater node D L ₂ corresponding to key K _DB (L ₂₎ ₂ L, and the routing path The second quantum key K _DE (L ₂ ) corresponding to the node D performs the operation corresponding to the second algorithm, and the calculation result of f _E (K _DB (L ₂ ), K _DE (L ₂ )) is as shown in FIG. 4 . The third quantum key K _BE (L ₂ ) corresponding to the relay node D of the routing path L ₂ ;

_{_{_{f E (K ED (L 2}}} ), K EG (L 2)) is a first routing path L E quantum relay node ₂ corresponding to key K _ED (L ₂₎ and the routing path L of the relay nodes ₂ The second quantum key K _EG (L ₂ ) corresponding to _E performs the operation corresponding to the second algorithm, and the calculation result of f _E (K _ED (L ₂ ), K _EG (L ₂ )) is as shown in FIG. a third quantum key K _DG (L ₂ ) corresponding to the relay node E of the routing path L ₂ ;

g(f _E (K _DB (L ₂ ), K _DE (L ₂ )), f _E (K _ED (L ₂ ), K _EG (L ₂ ))) is a relay node D corresponding to the routing path L ₂ The third quantum key K _BE (L ₂ ) and the third quantum key K _DG (L ₂ ) corresponding to the relay node E of the routing path L ₂ perform the operation corresponding to the first algorithm, when K _DE (L ₂ ) When identical to K _ED (L ₂ ), the result is equal to f _E (K _DB (L ₂ ), K _EG (L ₂ )).

When the above formula (1) is applied, and the calculation manner of the third quantum key corresponding to each node in FIG. 4 and the calculation manner of the second ciphertext corresponding to each node are combined with FIG. 4, the destination node is used. The operation performed by Q can be considered as shown in the following formula (2):

In the formula (2), it can be seen that after the destination node operates the received first ciphertext, the quantum key to be shared can be obtained. It can be known by those skilled in the art that in the actual operation of the destination node, the detailed calculation result as shown in the above formula (2) may not be performed, and only the destination node uses K _QG (L ₂ ) for the received K _G (L ₂ ). The operation corresponding to the first algorithm may be performed.

In the foregoing FIG. 4 and FIG. 5, only the first algorithm, the second algorithm, the third algorithm, and the fourth algorithm are all XOR algorithms are taken as an example. In the specific implementation process, the first algorithm, the second algorithm, and the third There are several implementations of the algorithm and the fourth algorithm. For example, two sets of first algorithms corresponding to two nodes are two sets of different algorithms, or two sets of second algorithms corresponding to two nodes are two sets of different algorithms.

For example, f _E (·) can be a function set, which can include a series of encryption functions {f _E0 , f _E1 ...}, and can also set a decryption function f _D , where f _E0 is the above third algorithm, For encrypting the quantum key to be shared between the source node and the destination node, f _E1 , f _E2 ... are respectively used by each relay node to calculate the third quantum key, and the received The function used by a ciphertext to perform the encryption operation is that the function corresponding to the first algorithm is the same as the function corresponding to the second algorithm (for example, f _E1 is the first relay node in the routing path used to calculate the first relay node) Corresponding third quantum key, and a function used for performing the encryption operation on the received first ciphertext, f _D is a fourth algorithm, that is, the destination node decrypts the received first ciphertext, thereby obtaining The quantum key to be shared. The two functions of the {f _E0 , f _E1 ... } and the f _D may be the same or different, and are not limited in the embodiment of the present application.

As can be seen from the above example, in the embodiment of the present application, the quantum key shared between the adjacent two nodes used in the quantum key distribution process is unknown (including the front node and the destination node are not known). Under the premise of a quantum key shared between nodes, any person can obtain the quantum key to be shared by acquiring the third quantum key of some or all nodes and the second ciphertext sent by the source node, thereby improving The security of the quantum key distribution process.

An embodiment of the present application further enumerates an optional implementation manner of the first algorithm and the second algorithm. For example, the second algorithm may be defined to perform a subtraction operation of the modulo 4 for each two bits, specifically:

For example, for any of the f _E (·) function sets {f _E0 , f _E1 ...}, the input is two binary sequences of length 2n, such as X=x ₁ x ₂ ...x _2k-1 x _2k ... x _2n-1 x _2n , Y = y ₁ y ₂ ... y _2k-1 y _2k ... y _2n-1 y _2n , whose output is still a binary sequence of length 2n, such as Z=z ₁ z ₂ ...z _2k-1 z _2k ...z _2n-1 z _2n =f _E (X,Y), then the calculation of z _2k-1 z _2k can follow the following calculation method:

Calculate a _k = 2x _2k-1 + x _2k , b _k = 2y _2k-1 + y _2k ; and:

If a _k ≥ b _k , then z _2k-1 z _2k is the binary representation of a _k -b _k ; if a _k <b _k , then z _2k-1 z _2k is the binary representation of a _k -b _k +4 .

While the decryption function f _D can perform the addition of modulo 4 for every two bits, it is not difficult to verify that the function in this example can also satisfy the above embodiment. It is to be noted that the above formula (1) is not a sufficient and sufficient condition for satisfying the solution provided by the embodiment of the present application, and is only a sufficient condition, and other functional forms satisfying the mathematical features of the above embodiment may be present, and the embodiment of the present application does not. Make restrictions.

The communication system to which the embodiment of the present application is applicable may include multiple routing paths. If N is an integer greater than 1, the first routing path and the second routing path in the N routing paths through the i-th node: the first route The first quantum key corresponding to the i-th node of the path is different from the first quantum key corresponding to the i-th node of the second routing path; the second quantum key corresponding to the i-th node of the first routing path The second quantum key corresponding to the i-th node of the two routing paths is different. The first routing path and the second routing path are two different routing paths in the N routing paths. As shown in FIG. 2 above, there are five routing paths through the relay node D, for any two of the routing paths, such as the routing path L ₁ and the routing path L ₅ , wherein the relay node D corresponds to the routing path L ₁ The first quantum key is different from the first quantum key corresponding to the relay node D in the routing path L ₅ , and the relay node D is in the routing path L ₁ corresponding to the second quantum key and the relay node D in the routing path The corresponding second quantum key in L ₅ is different. That is to say, for each routing path, the node allocates a corresponding quantum key for the routing path, thereby realizing one time and one secret, which can further improve the security of quantum key distribution. Moreover, the embodiment of the present application can be applied to the case of multipath, and the applicable network can be more complicated.

In practical applications, quantum communication systems will continuously generate quantum keys for push to the key management layer. Therefore, each quantum key can be assigned a number, and the number corresponding to the quantum key can also be called the quantum key. Corresponding identifier. Taking FIG. 2 as an example, the quantum key K _DE is continuously generated between the node D and the node E, and 256 bits can be used as a quantum key length, and each quantum key number corresponds to a 256-bit quantum key. There are multiple routing paths through node D and node E, such as routing path L ₁ , routing path L ₂ and routing path L _{3 shown in} FIG. Then, the node D and the node E respectively need to allocate the quantum key generated between the node D and the node E to the routing path L ₁ , the routing path L _{2 ,} and the routing path L ₃ . In the embodiment of the present application, the second quantum key allocated by the node D for one routing path and the first quantum key allocated by the node E for the target routing path are the same quantum key. For example, the node D is required to be the routing path L. _a second quantum key distribution node E L ₁ is assigned the routing path of the first quantum key is the same quantum key. In order to meet the requirement, the first correspondence may be acquired before the foregoing step 301, and the second correspondence is obtained before the step 302. The first correspondence and the second correspondence may be in various forms, for example, in the form of a table, or in the form of a text, etc., and the embodiments of the present application are not limited, and the following content is exemplarily described in the form of a table.

The first corresponding relationship in the foregoing step 301 and the second corresponding relationship in the foregoing step 302 may be obtained in multiple manners. In the following, the first implementation is performed by using the optional implementation a1, the implementation a2, and the implementation a3. The way in which the i-th node of the routing path corresponds to the first quantum key.

In the embodiment a1, the first quantum key indication information corresponding to the i th node indicating the target routing path in the first correspondence relationship is sent by the centralized controller.

The i th node receives the indication information of the first quantum key corresponding to the i th node of the target routing path sent by the centralized controller. In the embodiment of the present application, the indication information of the first quantum key corresponding to the i th node of the target routing path may be directly the first quantum key corresponding to the i th node of the target routing path, or may be other Information indicating this correspondence. Optionally, the i th node receives the indication information that is sent by the centralized controller and is used to indicate the second quantum key corresponding to the i th node of the target routing path. The centralized controller can collect the service request of the entire network, and can optimize the calculation of the routing path of the entire network. Then, the first correspondence corresponding to each node as a node can be uniformly calculated and then delivered to the corresponding node.

In the embodiment a2, the i th-1 node corresponding to the target routing path sends indication information indicating the first quantum key corresponding to the i th node of the target routing path in the first correspondence.

In this implementation manner, the i-1th node corresponding to the routing path may calculate the second quantum key corresponding to the i-1th node corresponding to the target routing path, and then send to the i th node, because the target route The second quantum key corresponding to the i-1th node corresponding to the path is the same as the first quantum key corresponding to the i th node corresponding to the target routing path, and therefore, the i th node can learn the first correspondence The first quantum key corresponding to the i-th node of the target routing path.

Based on this embodiment, in an optional implementation, each node in the target routing path (except the target node) calculates a second quantum key corresponding to each node on the target routing path, and then each Each node sends its own second quantum key on the target routing path to its next node on the target routing path, because each node corresponds to the second quantum key on the target routing path and each node The first node on the target routing path has the same first quantum key on the target routing path. Thus, the node in the target routing path can obtain the ith of the routing path in the first correspondence by way of embodiment a2. The first quantum key corresponding to the node.

In the embodiment a3, the i-th node determines the first quantum key corresponding to the i-th node of the target routing path according to the acquired network topology information of the quantum communication system and the first preset rule.

For the foregoing embodiment a3, the i-th node determines the first quantum key corresponding to the i-th node of the target routing path according to the acquired network topology information of the quantum communication system and the first preset rule, and may have multiple implementation manners. The following is described by way of optional embodiment a3-1, embodiment a3-2 and embodiment a3-3.

Embodiment a3-1

The i-th node is based on the ordering relationship between the numbers of the plurality of i-1th nodes in the N routing paths passing through the i-th node, and the nth i+ in the plurality of routing paths passing through the i-th node The ordering relationship between the number of one node and the ordering relationship between the numbers of the N routing paths of the i-th node determine the ordering of multiple routing paths through the i-th node, and sequentially determine The first quantum key corresponding to the i-th node of the target routing path.

FIG. 6 is a schematic diagram showing the first correspondence relationship corresponding to the generation of the node D by the node D application embodiment a3-1 in FIG. 2, as shown in FIG. 6, in the six routing paths shown in FIG. Each node will have a global number. Optionally, each node's global number can have a sort relationship. For example, it can be represented by Arabic numerals, or letters or some characters with a preset ordering relationship. ordering relationship between the nodes follow the alphabet letters corresponding to the sort, as shown in FIG 6, relay node as node D for all the routing path L ₁ to L _5, 5 to the nodes in the path from the route D The previous hop node is sorted. As shown in FIG. 6, there are two previous hop nodes of node D, which are node B and node C, respectively, and the sorting is as shown in the second column of FIG.

Further, the next hop node of the node D is the next hop node of the node D in the four routing paths of the node B, as shown in FIG. 6, when the previous hop node of the node D is the B node, the node D The next hop node is node E and node F, and the ordering is as shown in the second row to the fifth row in the third column of FIG. The next hop node of the node D is the next hop node of the node C in one routing path of the C node, as shown in FIG. 6, when the last hop node of the node D is the C node, the next node D The hop node is node F, and the ordering is as shown in the sixth row in the third column of FIG.

Further, when there are multiple routing paths through the previous hop node of the same node D and the next hop node passing the same node D, the routing may be sorted according to the global number of the routing path. Optionally, each routing path may have a number globally, and the routing path numbers may have a sorting relationship. It is assumed that the ordering numbers of the six routing paths in FIG. 2 are L ₁ to L _{6 in order} . 6, after the Node B, the path routing nodes D and E 3 are, respectively, L _1, L ₂ and L _3. Lines 2 through 4 of the fourth column are presented in a global ordering relationship according to the numbers of L _{1 ,} L _{2 ,} and L ₃ . There is only one routing path through node B, node D and node F, and there is only one routing path through node C, node D and node F, correspondingly ranked in the fifth row and sixth of the third column of Fig. 6. OK.

As can be seen from FIG. 6, the node D has already sorted all the routing paths passing through the node D, and then can assign the quantum key to each routing path according to the sorting relationship, as shown in the fourth column of FIG. The second row and the third behavior example in the fourth column of FIG. 6 are explained. The first quantum key assigned by the node D to the routing path L ₁ is K _DB (L ₁ ), and the node D is assigned to the routing path L ₂ . A quantum key is K _DB (L ₂ ).

Optionally, the quantum key consumption on a certain routing path may be relatively large. Therefore, the weight of each routing path may be set according to the quantum key consumption amount and/or the attribute information of the service on each routing path, thereby determining The number of quantum keys allocated for each quantum key distribution period for each routing path. That is, K _DB (L ₁ ) is only the identifier corresponding to the first quantum key assigned by the node D to the routing path L ₁ , and when only one quantum key is assigned to the routing path L1 in a quantum key allocation period, Assuming a quantum key length of 256 bits, K _DB (L ₁ ) may be a 256-bit quantum key corresponding identifier in each quantum key allocation period; if a quantum key distribution period is a routing path When L1 allocates multiple (such as 3) quantum keys, assuming a quantum key length of 256 bits, K _DB (L ₁ ) can be three 256-bit quantum keys in each quantum key allocation period. Corresponding identifier.

In a specific implementation, the routing scheme of the routing path is flexible, and FIG. 6 only shows one possible implementation manner, and may also have other implementation manners, for example, according to multiple routing paths passing through the i-th node. The ordering relationship between the numbers of the i+1th nodes sorts the plurality of i+1th nodes, and according to the number of the i-1th nodes in the plurality of routing paths passing through the i-th node The ordering relationship between the plurality of i-1th nodes is sorted, and then the routing paths are sorted according to the ordering relationship between the numbers of the plurality of routing paths of the i-th node, and so on, and details are not described herein.

Embodiment a3-2

The ordering relationship between the numbers of the i-th nodes in the N routing paths passing through the i-th node and the numbering of the N routing paths passing through the i-th node The relationship determines the order of the plurality of routing paths through the i-th node, and sequentially determines the first quantum key corresponding to the i-th node of the target routing path.

FIG. 7 exemplarily shows a schematic diagram of the first quantum key corresponding to the node D that generates the routing path L ₂ by the node D application embodiment a3-2 in FIG. 2, as shown in FIG. 7, in this example, it may be determined first. The plurality of routing paths through node D are L ₁ , L ₂ , L ₃ , L _{4 ,} and L _{5 , respectively} . Thereafter, the next hop ordering of the nodes D in the routing paths L ₁ , L ₂ , L ₃ , L _{4 ,} and L ₅ may be performed, as shown in the second row to the sixth row of the second column of FIG. 7 , passing through the node D The next hop corresponding to the multiple routing paths includes node E and node F, and then sorts the routing path numbers of the routing paths L ₁ , L ₂ , L ₃ , L _{4 ,} and L ₅ , and the ranking result is as shown in FIG. 7 . In the second row to the sixth row of the third column, the node D is assigned to each routing path in sequence according to the order of the routing paths L ₁ , L ₂ , L ₃ , L _{4 ,} and L ₅ . The first quantum key.

Embodiment a3-3

The i-th node determines the order of the N routing paths through the i-th node according to the ordering relationship between the numbers of the N routing paths passing through the i-th node, and sequentially determines the i-th of the target routing path. The first quantum key corresponding to each node.

FIG. 8 exemplarily shows a schematic diagram of the first quantum key corresponding to the node D of the node D applying the implementation manner a3-3 of FIG. 2 to generate the routing path L ₂ . As shown in FIG. 8 , the node D may be determined first. The plurality of routing paths are L ₁ , L ₂ , L ₃ , L _{4 ,} and L _{5 , respectively} . After that, the number of the routing paths of the routing paths L ₁ , L ₂ , L ₃ , L _{4 ,} and L ₅ can be sorted, and the sorting result is shown in the second row to the sixth row of the second column of FIG. 8 , and then The ordering of the routing paths L ₁ , L ₂ , L ₃ , L ₄ and L ₅ sequentially assigns a corresponding first quantum key to each routing path.

In the embodiment of the present application, the manners of obtaining the second quantum key corresponding to the i-th node of the routing path in the second correspondence relationship are introduced by the optional implementation manner b1, the implementation manner b2, and the embodiment b3.

In the embodiment b1, the indication information indicating the second quantum key corresponding to the i-th node of the routing path in the second correspondence relationship is sent by the centralized controller.

In the embodiment of the present application, the indication information of the second quantum key corresponding to the i th node of the routing path in the second correspondence relationship may be directly the first quantum key corresponding to the i th node of the target routing path. Other information indicating this correspondence may also be used. Optionally, the i th node receives the indication information that is sent by the centralized controller and is used to indicate the first quantum key corresponding to the i th node of the target routing path. The centralized controller can collect the service request of the entire network, and can optimize the calculation of the routing path of the entire network. Then, the second correspondence corresponding to each node as a node can be uniformly calculated and then delivered to the corresponding node.

In the embodiment b2, the indication information indicating the second quantum key corresponding to the i-th node of the routing path in the second correspondence relationship is sent by the (i+1)th node corresponding to the target routing path.

In this implementation manner, the i+1th node corresponding to the routing path may calculate the first quantum key corresponding to the i+1th node corresponding to the target routing path, and then send to the i th node, because the target route The first quantum key corresponding to the i+1th node corresponding to the path is the same as the second quantum key corresponding to the i th node corresponding to the target routing path, and therefore, the i th node can learn the second correspondence The second quantum key corresponding to the i-th node of the target routing path.

Based on this embodiment, in an optional implementation, each node in the target routing path (except the source node) calculates a first quantum key corresponding to each node on the target routing path, and then each Each node sends its first quantum key corresponding to the target routing path to its previous node on the target routing path, because each node corresponds to the first quantum key on the target routing path and each node The second node on the target routing path has the same second quantum key on the target routing path. Thus, the node in the target routing path can obtain the ith of the routing path in the second correspondence by the manner of embodiment b2. The second quantum key corresponding to the node.

In the embodiment b3, the i-th node determines the second quantum key corresponding to the i-th node of the target routing path according to the acquired network topology information of the quantum communication system and the second preset rule.

For the foregoing embodiment b3, the i-th node determines the second quantum key corresponding to the i-th node of the target routing path according to the acquired network topology information of the quantum communication system and the second preset rule, and may have multiple implementation manners. The following is described by way of alternative embodiment b3-1 and embodiment b3-2.

Embodiment b3-1

The i-th node according to the order relationship between the numbers of the plurality of i+2 nodes in the plurality of routing paths passing through the i-th node and the i+1th node in the target routing path, and the e-th The ordering relationship between the number of nodes and the number of routing paths of the i+1th node in the target routing path, and determining the number of i+1th nodes and the i+1th node in the target routing path Sorting the routing paths, and sequentially determining the second quantum key corresponding to the i-th node of the target routing path.

FIG. 9 exemplarily shows a schematic diagram of the second correspondence corresponding to the generation of the node D by the node D application embodiment b3-1 in FIG. 2, and as shown in FIG. 9, it is assumed that the quantum shared between the node D and the node E needs to be determined. For the key, all routing paths through node D and node E need to be determined first. As shown in FIG. 2, all routing paths through node D and node E are L ₁ , L ₂ and L ₃ . Thereafter, the next hop ordering of the node E in the routing paths L ₁ , L ₂ and L ₃ can be sorted, as shown in the second row to the fourth row of the second column of FIG. 6, the routing paths L ₁ , L ₂ next hop and two L ₃ in node E, node G and node are H, then for the next hop node E to node G by the multi-path routes, the multiple routes are sorted according to the number of paths, As shown in the second row to the third row of the third column of FIG. 9, the routing path of the node H after the next hop of the node E is only one, and it is arranged in the fourth row of the third column of FIG. Then, according to the order of the routing paths L ₁ , L ₂ and L ₃ , the second quantum key corresponding to each routing path of the node D is allocated for each routing path.

It can be seen that in the embodiment b3-1, multiple routing paths passing through the i-th node and the i+1th node in the target routing path are first filtered, and then the routing paths are sorted.

FIG. 10 exemplarily shows a first correspondence relationship between the node E application node a3-1 and the node E in FIG. 2, as shown in FIG. 10, all routing paths of the node E as a node are L ₁ , L ₂ , L ₃ and L ₆ , first sort the previous hop nodes of the node E in the four routing paths, as shown in FIG. 10, there are two upper hop nodes of the node E, respectively node D and node R. The sorting is shown in the second column of Figure 10.

Further, the last hop node of the node E is the next hop node of the node E in the three routing paths of the D node, as shown in FIG. 10, when the last hop node of the node E is the D node, the node E The next hop node is node G and node H, and the ordering is as shown in the second row to the fourth row in the third column of FIG. The next hop node of the node E is the next hop node of the node R in one routing path of the R node, as shown in FIG. 10, when the last hop node of the node E is the R node, the next node E The hop node is node H, and the ordering is as shown in the fifth row in the third column of FIG.

Further, as shown in FIG. 10, there are two routing paths through the node D, the node E, and the node G, which are respectively L ₁ and L ₂ . Lines 2 through 3 of the fourth column are presented in a global ordering relationship based on the numbers of L ₁ and L ₂ . There is only one routing path through node D, node E and node H, and there is only one routing path through node R, node E and node H, correspondingly ranked 4th and 5th in the third column of Fig. 10. OK.

It can be seen from FIG. 10 that the node E has already sorted all the routing paths that pass through the node E, and then assigns the first quantum key corresponding to each routing path corresponding to the node E to each routing path according to the ordering relationship. .

9 and FIG. 10, it can be found that the second to third columns of FIG. 9 are identical to the contents of the second to fourth rows of the third to fourth columns of FIG. 10, that is, the node D is determined. The rule of the second quantum key between the node D and the node E corresponding to the node D is the same as the rule that the node E determines the first quantum key between the node E and the node D, and therefore, the ith in the routing path can be guaranteed The second quantum key corresponding to the node is the same as the first quantum key corresponding to the i+1th node in the target routing path.

Embodiment b3-2

The i-th node determines, according to the order relationship between the number of the plurality of routing paths of the i-th node and the i+1th node in the target routing path, the i-th node and the target routing path Sorting the plurality of routing paths of the i+1th node, and sequentially determining the second quantum key corresponding to the i-th node of the target routing path.

FIG. 11 exemplarily shows a schematic diagram of the second quantum key corresponding to the node D in which the node D application embodiment b3-2 of FIG. 2 generates the routing path L ₂ . As shown in FIG. 11 , it is assumed that the routing path needs to be determined. The second quantum key corresponding to the node D of L ₂ may first determine that the plurality of routing paths passing through the node D and the node E are L ₁ , L ₂ and L _{3 , respectively} . Thereafter, the number of the routing paths of the routing paths L ₁ , L _{2 ,} and L ₃ can be sorted, and the sorting result is shown in the second row to the fourth row of FIG. 11 , and then according to the routing paths L ₁ , L ₂ , and L _{3 .} And the sorting of L ₄ sequentially assigns a corresponding first quantum key to each routing path.

It can be seen that, compared with the embodiment b3-1, the embodiment b3-2 firstly filters out multiple routing paths through the i-th node and the i+1th node in the target routing path, and then directly according to The number of the plurality of routing paths of the i-th node and the i+1th node in the target routing path is sorted, and in the foregoing embodiment b3-1, the node E in the plurality of routing paths is firstly used. The next hop nodes are sorted, and then sorted according to the number of the multiple routing paths.

In the above embodiments, FIG. 6 to FIG. 11 merely illustrate an exemplary implementation manner. In a specific application, there may be multiple types, such as an ith node according to an optional embodiment. The ordering relationship between the numbers of the plurality of i+1th nodes in the plurality of routing paths of the i-node, and the number of the i-th nodes in the plurality of routing paths passing through the i-th node The sorting relationship between the sorting relationship and the numbering of the plurality of routing paths through the i-th node determines the sorting of the plurality of routing paths through the i-th node, and sequentially determines the i-th of the target routing path The second quantum key corresponding to each node. Optionally, the i-th node is based on a sort relationship between the number of the i-th nodes in the plurality of routing paths passing through the i-th node and the i-1th node in the target routing path, And determining, by the order relationship between the number of the i-th node and the number of the plurality of routing paths of the i-1th node in the target routing path, determining the i-th node and the i-1th in the target routing path Sorting multiple routing paths of the nodes, and sequentially determining the first quantum key corresponding to the i-th node of the target routing path.

In the foregoing embodiment a2, the embodiment a3, the embodiment b2, and the embodiment b3, the first correspondence and/or the second correspondence may be calculated by each node, and the implementation may be based on a distributed information method, that is, The service request of the entire network may not be collected centrally, but the routing path of each service request is obtained by using the classical routing method, and then each routing path is correspondingly stored in each node through which the target routing path passes. Each node can calculate the first correspondence and/or the second correspondence according to its own internal topology information of all routing paths.

Any one of the above-described embodiment a1, the embodiment a2, and the embodiment a3 may be used in combination with any one of the embodiment b1, the embodiment b2, and the embodiment b3. For example, the above may be employed. In the embodiment a1, the first quantum key corresponding to the i-th node of the routing path in the first correspondence relationship is delivered by the centralized controller, and the second quantum key corresponding to the i-th node of the routing path in the second corresponding relationship is obtained. It can be calculated by the i-th node as shown in the above embodiment b3.

For another example, the first quantum key corresponding to the i-th node of the routing path in the first correspondence relationship may be sent by the i-1th node shown in the foregoing embodiment a2, and the routing path in the second correspondence relationship The second quantum key corresponding to the i-th node can be calculated by the i-th node as shown in the above embodiment b3.

For another example, the first quantum key corresponding to the i th node of the routing path in the first correspondence relationship may be calculated by the i th node in the foregoing embodiment a3, and the routing path in the second correspondence relationship The second quantum key corresponding to the i-th node may be issued by the (i+1)th node shown in the above embodiment b2.

For another example, the first quantum key corresponding to the i th node of the routing path in the first correspondence relationship may be calculated by the i th node in the foregoing embodiment a3, and the routing path in the second correspondence relationship The second quantum key corresponding to the i-th node can be calculated by the i-th node as shown in the above embodiment b3. In this example, the i-th node may also use any one of the implementation manners a3-1 to a3-3 to determine the first quantum key corresponding to the i-th node of the routing path, or b3- Any one of the embodiments 1 to b3-2 determines the second quantum key corresponding to the i-th node of the routing path, and the selection manner is flexible. For example, the implementation manners a3-1 and b3-1 may be combined or used. Embodiment a3-2 and Embodiment b3-2 are used in combination, and Embodiment a3-3 and Embodiment b3-2 may be used in combination.

Optionally, the table shown in FIG. 6 in the embodiment of the present application may be used cyclically. Taking FIG. 6 as an example, the routing paths through the node B and the node D have L ₁ , L ₂ , L _{3 ,} and L ₄ , and the sorting is sequentially performed. It is L ₁ , L ₂ , L ₃ , L ₄ . The first quantum key pushed from the QKD system connected to the node B and the node D can be assigned to the routing path L ₁ , and the identifier of the first quantum key can be represented by K _DB (L ₁ ) in FIG. 6 , and second The key is assigned to the routing path L ₂ , the third key is assigned to the routing path L ₃ , and the fourth key is assigned to the routing path L ₄ . When the local five keys come up, they are reassigned to the routing path. L ₁ , and so on, loops. When a quantum key is allocated to all of L1 to L4, it may be referred to as a quantum key allocation period. In one cycle, each routing path may be assigned a quantum key, or may be based on a weight or a preset rule. Different routing paths set different quantum key allocation numbers, for example, three quantum keys can be allocated to one routing path in one quantum key allocation period.

The quantum communication system in the embodiment of the present application can divide a plurality of local area networks. FIG. 12 exemplarily shows a schematic structural diagram of a local area network division in quantum communication provided by an embodiment of the present application. As shown in FIG. 12, a quantum communication network can be Dividing a plurality of local area networks, such as the local area network 1201 and the local area network 1202 shown in FIG. 12, gateway nodes may be set in each local area network, and one or more gateway nodes may be set in each local area network, and only one exemplary one is shown in FIG. An example of setting up a gateway node in a local area network. When the LAN nodes 1201 shown in FIG. 12 (such as M ₁ node) needs to communicate with the LAN nodes 1202 (node such as M _6), the node M ₁ S may be sent to the gateway node in the first data LAN 1201 _1, after the LAN 1201 to _a gateway node S transmits data corresponding to the LAN gateway node 1202 S _2, S ₂ forwarded by the gateway node to a local node in the M ₆ 1202. That is to say, when the nodes in different local area networks communicate, the source node can send data to the gateway node in the local area network to which the source node belongs, and then transmit to the gateway node in the local area network where the destination node is located, so that the destination node is located. The gateway node in the local area network is transmitted to the destination node. In this case, the routing path corresponding to the service request inside each local area network can be assisted by the gateway node inside the local area network, thereby reducing the pressure on the centralized controller.

Based on the above content, the embodiment of the present application provides a quantum communication method, and the specific operation process is as follows:

At 0 to T1, one or more nodes initiate an encrypted service request, and the encrypted service request may include an encrypted service request corresponding to the newly added service, and may also include canceling the encrypted service request corresponding to the existing service.

In an optional implementation manner, the node-initiated encrypted service request may be sent to the centralized controller or to the gateway node in the local area network where the node is located. Or set a centralized control end, and the encrypted service request initiated by the node may be sent to the centralized control end.

When the node sends an encrypted service request to the centralized controller, the centralized controller may plan a routing path corresponding to each encrypted service request. The routing path is planned by the centralized controller to optimize the routing path from a global perspective. The centralized controller in the embodiment of the present application may also be replaced by a centralized control terminal, or other devices having the functions of the centralized controller in the embodiment of the present application.

When the node sends an encrypted service request to the gateway node in the local area network where the node is located, the gateway node may plan a routing path inside the local area network where the gateway node is located. When the encrypted service request needs to span at least two local area networks, the centralized controller may plan. The routing path between the gateway node and the gateway node between different local area networks, this embodiment can alleviate the pressure of the centralized controller.

After the routing path is delivered, it can be delivered to each of the nodes included in the target routing path.

Optionally, it is also possible to record the key update rate required for each encrypted service. For a pair of nodes with a higher key update rate, multiple parallel routing paths can be used to increase the final total key acquisition rate, or to increase its weight on a certain routing path. When calculating the routing path, you can optimize the routing path according to the maximum key generation rate of each actual QKD link to prevent too many routing paths through the same link, thus limiting the key generation rate of these paths.

At the time of T1 to T2, each node determines the first corresponding relationship and the second corresponding relationship according to the information of the newly issued routing path. The specific manner may be the manner in the foregoing embodiment a1 to the embodiment b2. Let me repeat.

If each node still has the first correspondence and the second correspondence of the history, the first correspondence and the second correspondence of the history may be changed by using the newly acquired first correspondence and the second correspondence.

Optionally, during this time period, the destination node can reasonably process various types of information received during the time period.

At time T2 to T3, for each node in each node, the node calculates a third quantum key corresponding to the node of each routing path of the node according to the updated first correspondence relationship and the second correspondence relationship. The first quantum key and the second quantum key corresponding to the node of each routing path of the node are deleted within a preset duration after the result is calculated. The preset duration can be set to a smaller value, such as 1 minute or 30 seconds, which can improve the security of quantum key distribution.

Optionally, the node may disclose a third quantum key corresponding to the node of each routing path of the node, and related information of each routing path passing through the node. There are many ways for a node to disclose information, for example, it can be reported only to a centralized control node; it can be disclosed internally, that is, it can be disclosed among a group within a quantum network; it can be disclosed to a third party, such as to a third-party supervisory organization; The web is open because this part of the information does not affect security. But overall considerations can expose different information to different domains. Considering that this part of the public information will help to analyze the network situation if it is used properly, it is necessary to increase the authentication when the information is published to ensure that this information is sent by the node. In addition, the published information can be uploaded to the blockchain to further prevent tampering.

Optionally, for a source node in a routing path, the source node may be exposed at each of all nodes receiving the routing path: the node may expose the node passing through each routing path of the node Corresponding third quantum key, and related information of each routing path of the node, and then sending a second ciphertext corresponding to the source node.

Optionally, for a destination node in a routing path, the destination node may be disclosed at each of all nodes receiving the routing path: the node may disclose the node passing through each routing path of the node After the corresponding third quantum key and the related information of each routing path of the node, the quantum key to be shared between the source node and the destination node may be parsed from the second ciphertext corresponding to the source node. Optionally, the quantum key to be shared may be stored in a service key pool, where the service key pool belongs to a secure storage space.

Based on the same concept, the present application provides a quantum key distribution device 1301 for performing any of the aspects of the receiving side in the above method. FIG. 13 is a schematic structural diagram of a quantum key distribution apparatus provided by the present application. As shown in FIG. 13, the quantum key distribution apparatus 1301 includes a processor 1303, a transceiver 1302, a memory 1305, and a communication interface 1304. The processor 1303, the transceiver 1302, the memory 1305, and the communication interface 1304 are connected to each other through a bus. The quantum key distribution device 1301 in this example may be the i-th node in one of the foregoing routing paths, and those skilled in the art may know that the quantum key distribution device 1301 may also be a source node in other routing paths. A destination node or a node, which is implemented in the embodiment of the present application when the equivalent subkey distribution device 1301 is defined as a node.

The memory 1305 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory. A hard disk drive (HDD) or a solid-state drive (SSD); the memory 1305 may also include a combination of the above types of memories.

The communication interface 1304 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a WLAN interface.

The processor 1303 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1303 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.

Optionally, the memory 1305 can also be used to store program instructions, and the processor 1303 calls the program instructions stored in the memory 1305, and can perform one or more steps in the embodiment shown in the above scheme, or an optional implementation thereof. In a manner, the quantum key distribution device 1301 implements the function of the i-th node in the above method. The quantum key distribution device is the i-th node in a routing path of the quantum communication system. a processor 1303 in the quantum key distribution device, configured to determine, according to the first correspondence, a first quantum key corresponding to an i th node of the target routing path, and determine an i th target of the target routing path according to the second correspondence The second quantum key corresponding to the node generates the ith of the target routing path according to the first quantum key corresponding to the i-th node of the target routing path and the second quantum key corresponding to the i-th node of the target routing path. a third quantum key corresponding to the node; wherein, the i th node is the i th node in the target routing path; the first quantum key corresponding to the i th node of the target routing path is the i th obtained by the i th node The quantum key shared between the node and the i-1th node in the target routing path, the first correspondence relationship includes N first quantum keys corresponding to the i th node through the N routing paths of the i th node Corresponding relationship, the N routing paths correspond to the N first quantum keys corresponding to the i-th node, and the target routing path is one of the N routing paths, N is a positive integer, and i is a positive integer Target routing The second quantum key corresponding to the i-th node of the path is a quantum key shared between the i-th node acquired by the i-th node and the i+1th node in the target routing path, and the second correspondence includes The correspondence between the N routing paths of the i-th node and the N second quantum keys corresponding to the i-th node, and the N routing paths and the N second quantum keys corresponding to the i-th node are in one-to-one correspondence; The third quantum key corresponding to the i th node of the target routing path is sent to the target node of the target routing path; or the third quantum corresponding to the i th node of the target routing path is used by the processor The second ciphertext corresponding to the i-th node obtained by encrypting the received first ciphertext of the i-th node in the target routing path is sent to the i+1th of the target routing path. node.

The first ciphertext received by the i-th node from the i-1th node in the target routing path is the second ciphertext corresponding to the i-1th node sent by the i-1th node; When the value is 1, the 0th node is the source node of the target routing path, and the second ciphertext corresponding to the source node of the target routing path is the source node of the second quantum key pair target routing path corresponding to the source node of the target routing path. The quantum key to be shared with the target node of the target routing path is encrypted.

In a possible implementation manner, if N is an integer greater than 1, the first routing path and the second routing path in the N routing paths through the i-th node: the i-th node of the first routing path The corresponding first quantum key is different from the first quantum key corresponding to the i th node of the second routing path; the second quantum key corresponding to the i th node of the first routing path and the i th second of the second routing path The second quantum key corresponding to each node is different.

In a possible implementation manner, the transceiver 1302 is further configured to receive, by the ith node of the centralized controller or the target routing path, an ith information indicating a target routing path in the first correspondence. The node corresponds to the indication information of the first quantum key of the target routing path; or the processor 1303 is further configured to determine the target routing path in the first correspondence according to the acquired network topology information of the quantum communication system and the first preset rule. The i-th node corresponds to the first quantum key of the target routing path.

There are a plurality of manners for determining the first quantum key corresponding to the i-th node of the target routing path. For details, refer to the descriptions of Embodiment a3-1, Embodiment a3-2, and Embodiment a3-3 in the foregoing. I will not repeat them here.

In a possible implementation manner, the transceiver 1302 is configured to: receive, by the centralized controller or the i+1th node corresponding to the target routing path, the ith information indicating the target routing path in the second correspondence relationship The indication information of the second quantum key corresponding to the node; or the processor 1303, configured to determine the ith of the target routing path in the second correspondence according to the acquired network topology information of the quantum communication system and the second preset rule The second quantum key corresponding to the node.

For the determination of the second quantum key corresponding to the i-th node of the target routing path, refer to the description of the embodiment b3-1 and the embodiment b3-2 in the foregoing, and details are not described herein again.

Based on the same concept, the embodiment of the present application provides a quantum key distribution apparatus for performing any one of the i-th node side in the foregoing method flow. FIG. 14 exemplarily shows a schematic structural diagram of a quantum key distribution apparatus according to an embodiment of the present application. As shown in FIG. 14, the quantum key distribution apparatus 1401 includes a transceiver unit 1402 and a processing unit 1403. The quantum key distribution device 1401 in this example may be the i-th node in one of the foregoing routing paths. As is known to those skilled in the art, the quantum key distribution device 1401 may also be a source node in other routing paths. A destination node or a node, which is implemented when the equivalent subkey distribution device 1401 is defined as a node in the embodiment of the present application.

The processing unit 1403 is configured to determine, according to the first correspondence, a first quantum key corresponding to the i-th node of the target routing path, and determine, according to the second correspondence, a second quantum density corresponding to the i-th node of the target routing path. Key, according to the first quantum key corresponding to the i-th node of the target routing path and the second quantum key corresponding to the i-th node of the target routing path, generating a third quantum key corresponding to the i-th node of the target routing path Key; wherein, the i th node is the i th node in the target routing path; the first quantum key corresponding to the i th node of the target routing path is the i th node and the target routing path acquired by the i th node The quantum key shared between the i-1th nodes, the first correspondence relationship includes the correspondence between the N routing paths of the i-th node and the N first quantum keys corresponding to the i-th node, and N routes The path is in one-to-one correspondence with the N first quantum keys corresponding to the i-th node, and the target routing path is one of the N routing paths, N is a positive integer, i is a positive integer; the i-th of the target routing path Node correspondence The second quantum key is a quantum key shared between the i th node acquired by the i th node and the i+1 th node in the target routing path, and the second correspondence relationship includes N pieces passing through the i th node Corresponding relationship between the routing path and the N second quantum keys corresponding to the i-th node, the N routing paths and the N second quantum keys corresponding to the i-th node are in one-to-one correspondence; the transceiver 1402 is configured to target The third quantum key corresponding to the i-th node of the routing path is sent to the target node of the target routing path; or; the received by the processor using the third quantum key pair corresponding to the i-th node of the target routing path The second ciphertext corresponding to the i-th node obtained by encrypting the first ciphertext of the i-1th node in the target routing path is sent to the i+1th node in the target routing path.

The first ciphertext received by the i-th node from the i-1th node in the target routing path is the second ciphertext corresponding to the i-1th node sent by the i-1th node; When the value is 1, the 0th node is the source node of the target routing path, and the second ciphertext corresponding to the source node of the target routing path is the source node of the second quantum key pair target routing path corresponding to the source node of the target routing path. The quantum key to be shared with the target node of the target routing path is encrypted. The second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path; and the i th node corresponding to the target routing path corresponds to The second quantum key is the same as the first quantum key corresponding to the i+1th node of the target routing path.

It should be understood that the division of the units of each of the above quantum key distribution devices is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated. In the embodiment of the present application, the transceiver unit 1402 can be implemented by the transceiver 1302 of FIG. 13 above, and the processing unit 1403 can be implemented by the processor 1303 of FIG. 13 described above. That is, the transceiver unit 1402 in the embodiment of the present application may perform the solution executed by the transceiver 1302 of FIG. 13 , and the processing unit 1403 in the embodiment of the present application may execute the solution executed by the processor 1303 of FIG. 13 , and the rest of the content. Please refer to the above content, and details are not described herein again. As shown in FIG. 13 above, the memory 1305 included in the quantum key distribution device 1301 can be used to store a code when the processor 1303 included in the quantum key distribution device 1301 executes a scheme, and the code can be a quantum key distribution device 1301. Program/code pre-installed at the factory.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof, and when implemented using a software program, may be implemented in whole or in part in the form of a computer program product. A computer program product includes one or more instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions in accordance with embodiments of the present application are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The instructions may be stored on a computer storage medium or transferred from one computer storage medium to another computer storage medium, for example, instructions may be wired from a website site, computer, server or data center (eg, coaxial cable, fiber optic, digital user) Line (DSL) or wireless (eg infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center. The computer storage medium can be any available media that can be accessed by the computer or a data storage device such as a server, data center, or the like, including one or more available media. Usable media can be magnetic media (eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical media (eg, CD, DVD, BD, HVD, etc.), or semiconductor media (eg, ROM, EPROM, EEPROM, Non-volatile memory (NAND FLASH), solid state disk (SSD), etc.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowcharts and/or block diagrams, and combinations of flow and/or blocks in the flowcharts and/or <RTIgt; These instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine such that instructions executed by a processor of a computer or other programmable data processing device are utilized for implementation A means of function specified in a flow or a flow and/or a block diagram of a block or blocks.

The instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. A function specified in a block or blocks of a flow or a flow and/or a block diagram of a flow chart.

These instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for providing instructions for execution on a computer or other programmable device The steps used to implement the functions specified in one or more of the flow or in a block or blocks of the flowchart.

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the embodiments of the present invention.

Claims

A quantum key distribution method, comprising:

The i-th node determines, according to the first correspondence, a first quantum key corresponding to the i-th node of the target routing path, where the i-th node is the i-th node in the target routing path; The first quantum key corresponding to the i-th node of the target routing path is a quantum key shared between the i-th node acquired by the i-th node and the i-th node in the target routing path The first correspondence relationship includes a correspondence between N routing paths of the i-th node and N first quantum keys corresponding to the i-th node, the N routing paths and the first The N first quantum keys corresponding to the i nodes are in one-to-one correspondence, the target routing path is one of the N routing paths, the N is a positive integer, and the i is a positive integer. ;

The i-th node determines, according to the second correspondence, a second quantum key corresponding to the i-th node of the target routing path, and the second quantum corresponding to the i-th node of the target routing path a key is a quantum key shared between the i th node acquired by the i th node and an i+1 th node in the target routing path, where the second correspondence includes Correspondence between N routing paths of i nodes and N second quantum keys corresponding to the i th node, the N routing paths and the N second quantum corresponding to the i th node One-to-one correspondence of keys;

And generating, by the i th node, the first quantum key corresponding to the i th node of the target routing path and a second quantum key corresponding to the i th node of the target routing path a third quantum key corresponding to the i-th node of the target routing path;

The i-th node sends a third quantum key corresponding to the i-th node of the target routing path to a target node of the target routing path; or the i-th node uses the target route The third quantum key corresponding to the i-th node of the path encrypts the received first ciphertext from the i-1th node in the target routing path, and the obtained i-th node Corresponding second ciphertext is sent to the i+1th node in the target routing path, where the i-th node receives the first node from the i-1th node in the target routing path The ciphertext is a second ciphertext corresponding to the i-1th node sent by the i-1th node; when the i is 1, the 0th node is a source node of the target routing path, The second ciphertext corresponding to the source node of the target routing path is a source node of the target routing path and a target node of the target routing path by using a second quantum key corresponding to the source node of the target routing path. Encrypted by sharing a quantum key;

The second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path; and, in the target routing path The second quantum key corresponding to the i-th node is the same as the first quantum key corresponding to the i+1th node of the target routing path.
The method according to claim 1, wherein if the N is an integer greater than 1, the first routing path and the second routing path in the N routing paths through the i-th node:

The first quantum key corresponding to the i th node of the first routing path is different from the first quantum key corresponding to the i th node of the second routing path;

The second quantum key corresponding to the i th node of the first routing path is different from the second quantum key corresponding to the i th node of the second routing path.
The method according to claim 1 or 2, wherein before the determining, by the i-th node, the first quantum key corresponding to the i-th node of the target routing path according to the first correspondence, the method further includes:

The i-th node receives the i-th node corresponding to the target routing path in the first correspondence relationship that is sent by the i-th node in the centralized controller or the target routing path The indication information of the first quantum key of the target routing path;

or;

Determining, by the i-th node, the i-th node of the target routing path in the first correspondence relationship corresponding to the target routing path according to the acquired network topology information of the quantum communication system and the first preset rule The first quantum key.
The method according to claim 3, wherein the i-th node determines the target routing path in the first correspondence according to the acquired network topology information of the quantum communication system and the first preset rule The i-th node corresponds to the first quantum key of the target routing path, and includes:

The i-th node passes through the N-th routing path of the i-th node according to the order relationship between the numbers of the N th-1th nodes in the N routing paths of the i-th node The ordering relationship between the numbers of the N th+1th nodes, and the ordering relationship between the numbers of the N routing paths through the i-th node, determining N pieces passing through the i-th node Sorting the routing paths, and sequentially determining the first quantum key corresponding to the i-th node of the target routing path;

or;

The i-th node according to a sorting relationship between numbers of N th+1th nodes in N routing paths passing through the i-th node, and N routing paths passing through the i-th node a sorting relationship between the numbers, determining the sorting of the N routing paths through the i-th node, and sequentially determining the first quantum key corresponding to the i-th node of the target routing path;

or;

The i-th node determines, according to the ordering relationship between the numbers of the N routing paths of the i-th node, sorting the N routing paths that pass the i-th node, and sequentially determines the a first quantum key corresponding to the i-th node of the target routing path.
The method according to any one of claims 1 to 4, wherein the i-th node determines a second quantum key corresponding to the i-th node of the target routing path according to the second correspondence Previously, it also included:

The i-th node receives the i-th node corresponding to the target routing path sent by the centralized controller or the i+1th node corresponding to the target routing path, and is used to indicate the target routing path in the second correspondence Indication information of the second quantum key;

or;

Determining, by the i-th node, the second quantum key corresponding to the i-th node of the target routing path in the second correspondence relationship according to the acquired network topology information of the quantum communication system and the second preset rule .
The method according to claim 5, wherein the i-th node determines the target routing path in the second correspondence according to the acquired network topology information of the quantum communication system and the second preset rule The second quantum key corresponding to the i-th node includes:

The i-th node determines, according to the order relationship between the numbers of the W routing paths passing through the i-th node and the i+1th node in the target routing path, that the i-th node passes And sorting the W routing paths of the i+1th node in the target routing path, and sequentially determining the second quantum key corresponding to the i th node of the target routing path; a positive integer not greater than the N;

or;

The i-th node according to a ranking relationship between the numbers of the i i+2 nodes in the W routing paths passing through the i-th node and the i+1th node in the target routing path And determining, by the order relationship between the number of the W routing paths of the i-th node and the i+1th node in the target routing path, determining the e-th node and the target route Sorting the W routing paths of the i+1th node in the path, and sequentially determining the second quantum key corresponding to the i th node of the target routing path.
The method according to any one of claims 1 to 6, wherein the i-th node receives the received source from the third quantum key pair corresponding to the i-th node of the target routing path The first algorithm for encrypting the first ciphertext of the i-1th node in the target routing path satisfies the following formula:

g(f E (K i-1,i-2 (L j ),K i-1,i (L j )),f E (K i,i-1 (L j ),K i,i+1 (L j )))=f E (K i-1,i-2 (L j ),K i,i+1 (L j ))

Wherein the L j is an identifier of the target routing path;

The K i-1,i-2 (L j ) is a first quantum key corresponding to the i-1th node in the target routing path L j ;

The K i-1,i (L j ) is a second quantum key corresponding to the i-1th node in the target routing path L j ;

The K i,i-1 (L j ) is a first quantum key corresponding to the i th node in the target routing path L j ;

The K i,i+1 (L j ) is a second quantum key corresponding to the i th node in the target routing path L j ;

Wherein f E (·) is a function corresponding to the second algorithm, and the second algorithm is the first quantum key corresponding to the i-th node according to the target routing path and the target routing path An algorithm used by the second quantum key corresponding to the i-th node to generate a third quantum key corresponding to the i-th node of the target routing path;

g(·) is a function corresponding to the first algorithm.
A quantum key distribution device, wherein the quantum key distribution device is an i-th node in a routing path of a quantum communication system, and the quantum key distribution device includes:

a processor, configured to determine, according to the first correspondence, a first quantum key corresponding to an i th node of the target routing path, and determine, according to the second correspondence, a corresponding one of the i th nodes of the target routing path a second quantum key, generating the target according to a first quantum key corresponding to the i-th node of the target routing path and a second quantum key corresponding to the i-th node of the target routing path a third quantum key corresponding to the i-th node of the routing path; wherein the i-th node is an i-th node in the target routing path; and an i-th node of the target routing path corresponds to a first quantum key is a quantum key shared between the i th node acquired by the i th node and an i th th node in the target routing path, where the first correspondence includes a pass through Corresponding relationship between the N routing paths of the i-th node and the N first quantum keys corresponding to the i-th node, the N routing paths and the N-th nodes corresponding to the i-th node a quantum key one-to-one correspondence, the target routing path One of the N routing paths, the N is a positive integer, and the i is a positive integer; the second quantum key corresponding to the ith node of the target routing path is the first a quantum key shared between the i-th node acquired by the i-th node and the i+1th node in the target routing path, where the second correspondence relationship includes N pieces passing through the i-th node Corresponding relationship between the routing path and the N second quantum keys corresponding to the i-th node, the N routing paths and the N second quantum keys corresponding to the i-th node are in one-to-one correspondence;

a transceiver, configured to send a third quantum key corresponding to the i th node of the target routing path to a target node of the target routing path; or; use the target routing path by using the processor The third quantum key corresponding to the i-th node corresponds to the received i-th node obtained by encrypting the first ciphertext from the i-1th node in the target routing path. Sending a second ciphertext to the i+1th node in the target routing path;

The first ciphertext received by the ith node from the i-1th node in the target routing path is corresponding to the i-1th node sent by the i-1th node a second ciphertext; when the i is 1, the 0th node is the source node of the target routing path, and the second ciphertext corresponding to the source node of the target routing path is the target routing path And obtaining, by the second quantum key corresponding to the source node, a quantum key to be shared between the source node of the target routing path and the target node of the target routing path;

The second quantum key corresponding to the i-1th node in the target routing path is the same as the first quantum key corresponding to the i th node of the target routing path; and, in the target routing path The second quantum key corresponding to the i-th node is the same as the first quantum key corresponding to the i+1th node of the target routing path.
The device according to claim 8, wherein if the N is an integer greater than 1, the first routing path and the second routing path in the N routing paths through the i-th node:

The first quantum key corresponding to the i th node of the first routing path is different from the first quantum key corresponding to the i th node of the second routing path;

The second quantum key corresponding to the i th node of the first routing path is different from the second quantum key corresponding to the i th node of the second routing path.
The device according to claim 8 or 9, wherein the transceiver is further configured to receive, by the centralized controller or the i-1th node in the target routing path, the first The i-th node of the target routing path in the correspondence relationship corresponds to the indication information of the first quantum key of the target routing path;

or;

The processor is further configured to determine, according to the acquired network topology information of the quantum communication system, and the first preset rule, that the i th node of the target routing path in the first correspondence corresponds to the target route The first quantum key of the path.
The device according to claim 10, wherein said processor is configured to:

Obtaining an order relationship between the numbers of the N th-1th nodes in the N routing paths of the i-th node, and N i++s of the N routing paths passing through the i-th node Sorting relationship between numbers of one node, and sorting relationship between numbers of N routing paths through the i-th node, determining ordering of N routing paths through the i-th node, and Determining, in sequence, a first quantum key corresponding to the i-th node of the target routing path;

or;

Sorting between the numbers of the N th+1th nodes in the N routing paths through the i-th node, and the ordering between the numbers of the N routing paths passing through the i-th node a relationship, determining, by the ordering of the N routing paths of the i-th node, and sequentially determining a first quantum key corresponding to the i-th node of the target routing path;

or;

Determining the order of the N routing paths passing the i-th node according to the sorting relationship between the numbers of the N routing paths of the i-th node, and sequentially determining the location of the target routing path The first quantum key corresponding to the i-th node.
The device according to any one of claims 8 to 11, wherein the transceiver is further configured to receive, by the centralized controller or the i+1th node corresponding to the target routing path, an indication The indication information of the second quantum key corresponding to the i-th node of the target routing path in the second correspondence relationship;

or;

The processor is further configured to determine, according to the acquired network topology information of the quantum communication system and the second preset rule, a second quantum corresponding to the i-th node of the target routing path in the second correspondence Key.
The device according to claim 12, wherein said processor is configured to:

Determining the passing of the i-th node and the target routing path according to a sort relationship between the number of the W routing paths of the i-th node and the i+1th node in the target routing path Sorting the W routing paths of the i+1th node, and sequentially determining the second quantum key corresponding to the i th node of the target routing path; the W is not greater than the N Positive integer

or;

And according to the order relationship between the numbers of the W i+2 nodes in the W routing paths passing through the i-th node and the i+1th node in the target routing path, and And determining, by the i-th node, an order relationship between the number of the W routing paths of the i+1th node in the target routing path, and determining the i+ through the i-th node and the target routing path Sorting the W routing paths of one node, and sequentially determining the second quantum key corresponding to the i-th node of the target routing path.
The apparatus according to any one of claims 8 to 13, wherein the processor receives the received target from the third quantum key pair corresponding to the i-th node of the target routing path The first algorithm for encrypting the first ciphertext of the i-1th node in the routing path satisfies the following formula:

g(f E (K i-1,i-2 (L j ),K i-1,i (L j )),f E (K i,i-1 (L j ),K i,i+1 (L j )))=f E (K i-1,i-2 (L j ),K i,i+1 (L j ))

Wherein the L j is an identifier of the target routing path;

The K i-1,i-2 (L j ) is a first quantum key corresponding to the i-1th node in the target routing path L j ;

The K i-1,i (L j ) is a second quantum key corresponding to the i-1th node in the target routing path L j ;

The K i,i-1 (L j ) is a first quantum key corresponding to the i th node in the target routing path L j ;

The K i,i+1 (L j ) is a second quantum key corresponding to the i th node in the target routing path L j ;

Wherein f E (·) is a function corresponding to the second algorithm, and the second algorithm is the first quantum key corresponding to the i-th node according to the target routing path and the target routing path An algorithm used by the second quantum key corresponding to the i-th node to generate a third quantum key corresponding to the i-th node of the target routing path;

g(·) is a function corresponding to the first algorithm.
A computer storage medium, characterized in that the computer storage medium stores computer executable instructions that, when invoked by a computer, cause the computer to perform any of claims 1 to 7 The method described.